CSA Tells Singapore Firms to Take OT Control Systems Off the Internet After Europe's Fridge Attacks

Singapore's Cyber Security Agency (CSA) published an advisory on attacks against remotely accessible operational technology (OT) control systems on 6 November. It tells any organisation running them to make sure remote management interfaces "are not publicly accessible". The advisory opens with the wave of attacks that pushed up temperatures in supermarket fridges and freezers across Europe, which also reached the cold rooms of France's blood service. CSA has not received reports of similar incidents in Singapore, AsiaOne reports.

Why a fridge hack concerns other sectors

The same exposure, CSA writes, sits in energy and utilities infrastructure, water treatment and cold-storage logistics, as well as healthcare facility management systems. A tampered controller there "could result in physical damage to equipment, safety hazards, service disruptions".

In Europe the attacks affected hundreds of supermarkets in France before spreading to Belgium, Luxembourg, Sweden and Ireland. CSA says the intrusion methods are still under investigation, and lists "weak or default credentials, outdated software and insufficient access controls" as potential weaknesses.

It names no vendor or product.

What operators are told to do

The advisory starts with an inventory: list every remote management system and controller, check which are reachable from the internet, and recheck regularly. Unneeded services, ports and remote functions get switched off.

Where remote access can't be dropped, route it through "secure remote access solutions, such as Virtual Private Networks (VPNs)". Replace default passwords and turn on multi-factor authentication (MFA) wherever the device supports it. Controllers should answer only allowlisted IP addresses and accounts; delete the accounts nobody uses.

Patch the firmware and the network gear around it, and review equipment that has reached end-of-life. Keep OT networks apart from corporate IT and alert on remote logins and configuration changes. If a controller is tampered with, staff need to be able to isolate it and "revert to local or manual controls where supported".